LiteLLM command injection CVE-2026-42271 used in attacks; fixes available
Attackers are using a LiteLLM AI gateway flaw that lets even low-privilege users run code on its server. Organisations should update to 1.83.7 or later, apply relevant Red Hat fixes and check for compromise.
If your business or family office runs LiteLLM, ask its IT team to update to a supported release at least as new as 1.83.7, or install the applicable Red Hat security update. If updating must wait, BerriAI says to block POST requests to /mcp-rest/test/connection and /mcp-rest/test/tools/list at the reverse proxy or API gateway. Ask IT to check for compromise as well as patching.
What’s happening
BerriAI LiteLLM, software organisations use to connect applications to AI services, had a flaw in functions for testing Model Context Protocol (MCP) server connections. A valid LiteLLM API key was enough to run commands with the gateway process's permissions, even if the key belonged to a low-privilege user. BerriAI identifies versions 1.74.2 to before 1.83.7 as affected and fixed the flaw in 1.83.7, released on 19 April. CISA confirmed exploitation by adding it to its catalogue on 8 June. Red Hat subsequently shipped fixes for affected OpenShift AI components on 22–25 June. October research from Black Lotus Labs identified this vulnerability as a likely entry route for PoeLLM, malware that mines cryptocurrency and reuses compromised servers to attack others. Fixes are available, but the research reported continuing infections; it did not establish that the campaign had ended.
- What
- Flaw
- Affects
- BerriAI LiteLLM AI gateway and affected Red Hat OpenShift AI components
- Affected
- LiteLLM >=1.74.2, <1.83.7
Red Hat OpenShift AI 3.4: rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 before RHSA-2026:27784
Red Hat OpenShift AI 3.3: rhoai/odh-llama-stack-core-rhel9 before RHSA-2026:30056
Red Hat OpenShift AI 2.25: rhoai/odh-llama-stack-core-rhel9 before RHSA-2026:28960 - Fixed in
- LiteLLM >=1.83.7; stable release v1.83.7-stable
Red Hat OpenShift AI 3.4: RHSA-2026:27784
Red Hat OpenShift AI 3.3: RHSA-2026:30056
Red Hat OpenShift AI 2.25: RHSA-2026:28960 - Since
- 8 June 2026
- Closed
- 11 Oct 2026
Timeline
- Wider attacks
Reporting on Black Lotus Labs' PoeLLM investigation linked CVE-2026-42271 to the campaign as a likely route into LiteLLM servers. The cryptomining campaign was still infecting systems when the research was published; its victims spanned several products.
- New fixFixed
Red Hat released RHSA-2026:30056 for OpenShift AI 3.3's affected Llama Stack core component. Its current assessment lists fixes for all three affected OpenShift AI entries.
- New fixPartly fixed
Red Hat released RHSA-2026:28960 for the affected Llama Stack core component in OpenShift AI 2.25.
- New fixPartly fixed
Red Hat released RHSA-2026:27784 for the affected TrustyAI Garak LLS provider component in OpenShift AI 3.4.
- CISA added
CISA added CVE-2026-42271 to its Known Exploited Vulnerabilities catalogue, confirming use in attacks. It set a 22 June remediation deadline for US federal civilian agencies; ransomware use was unknown.
- Made public
BerriAI published its advisory: LiteLLM versions from 1.74.2 to before 1.83.7 let users with low-privilege API keys run commands on the server. Version 1.83.7 restricts the affected test functions to proxy administrators.
- New fixPartly fixed
BerriAI released LiteLLM v1.83.7-stable, the release its advisory identifies as fixing CVE-2026-42271.
Sources
- Authenticated command execution via MCP stdio test endpointsBerriAI · 21 Apr 2026
- Release v1.83.7-stableBerriAI · 19 Apr 2026
- CISA Known Exploited Vulnerabilities catalogue — official dataCISA · 3 Nov 2026
- CVE-2026-42271Red Hat · 30 June 2026
- Canto incognito: tracking the PoeLLM malwareLumen Black Lotus Labs
- Cryptomining malware used poetry to infect more than 3,400 servers, researchers sayTom's Hardware · 11 Oct 2026